Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics

TL;DR

This paper demonstrates that adversarial training, especially with output-space attacks, enhances both generalization and robustness of audio classification models under real-world distribution shifts, using bird sound data.

Contribution

It introduces and evaluates adversarial training strategies for improving model robustness and generalization in bioacoustic classification under distribution shifts.

Findings

Adversarial training improves clean data accuracy by 10.5%

Output-space attack training enhances robustness against adversarial attacks

Models maintain stability under targeted embedding-space attacks

Abstract

Adversarial training is a promising strategy for enhancing model robustness against adversarial attacks. However, its impact on generalization under substantial data distribution shifts in audio classification remains largely unexplored. To address this gap, this work investigates how different adversarial training strategies improve generalization performance and adversarial robustness in audio classification. The study focuses on two model architectures: a conventional convolutional neural network (ConvNeXt) and an inherently interpretable prototype-based model (AudioProtoPNet). The approach is evaluated using a challenging bird sound classification benchmark. This benchmark is characterized by pronounced distribution shifts between training and test data due to varying environmental conditions and recording methods, a common real-world challenge. The investigation explores two adversarial training strategies: one based on output-space attacks that maximize the classification loss function, and another based on embedding-space attacks designed to maximize embedding dissimilarity. These attack types are also used for robustness evaluation. Additionally, for AudioProtoPNet, the study assesses the stability of its learned prototypes under targeted embedding-space attacks. Results show that adversarial training, particularly using output-space attacks, improves clean test data performance by an average of 10.5% relative and simultaneously strengthens the adversarial robustness of the models. These findings, although derived from the bird sound domain, suggest that adversarial training holds potential to enhance robustness against both strong distribution shifts and adversarial attacks in challenging audio classification settings.